lulzsecurity
New Member
Before you ask, I've alerted Matt from WHMCS today, I won't post exactly, but the cleaning is horrific. To give you a few sense about this,
Attacker A -> register, orders vps, due to improper cleaning on whmcs part, we can abuse this.
Attacker A then gets full access to the machine using zero-day.
Improper cleaning of "$whmcs->sanitize_input_vars()". If legit admin user a for example does this:
Register, order vps but has special chars that were not filtered by cleaning, we can then break the cmd and exec()ute more commands.
Now I must get mad at their bad coding..
function {snipped}($arr) {
global $whmcs;
{snipped}
}
$whmcs = new WHMCS_Init();
$whmcs = $whmcs->init();
All of that is in the same file, no need to global it, as its already created the instance. I wonder where they learned how to program, -,-.
Multiple issues with poor coding, however a vulnerability if not patched could lead to multiple zero-days on anything/everything that uses cleaning and relies on it.
I will disclose exactly how to do this IF they do not fix it.
Attacker A -> register, orders vps, due to improper cleaning on whmcs part, we can abuse this.
Attacker A then gets full access to the machine using zero-day.
Improper cleaning of "$whmcs->sanitize_input_vars()". If legit admin user a for example does this:
Register, order vps but has special chars that were not filtered by cleaning, we can then break the cmd and exec()ute more commands.
Now I must get mad at their bad coding..
function {snipped}($arr) {
global $whmcs;
{snipped}
}
$whmcs = new WHMCS_Init();
$whmcs = $whmcs->init();
All of that is in the same file, no need to global it, as its already created the instance. I wonder where they learned how to program, -,-.
Multiple issues with poor coding, however a vulnerability if not patched could lead to multiple zero-days on anything/everything that uses cleaning and relies on it.
I will disclose exactly how to do this IF they do not fix it.
Last edited by a moderator:
